Duck-organization vulnerabilities

Products

• Quest-bot 10
• Questbot 6

Newest

• duck-organization questbot Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services CVE-2026-61840 2.3 LowOctober 30, 2026
• duck-organization questbot Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown CVE-2026-49347 5.3 MediumJune 12, 2026
• duck-organization questbot Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`. CVE-2026-48485 2.1 LowJune 12, 2026
• duck-organization questbot Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands CVE-2026-47197 7.2 HighJune 12, 2026
• duck-organization questbot Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands. CVE-2026-47195 7.1 HighJune 12, 2026
• duck-organization questbot Quest Bot: Empty automod rule causes every guild message to be deleted CVE-2026-47196 8.4 HighJune 12, 2026
• duck-organization duck-site Duck Site: Untrusted pull request code can trigger privileged production deployment CVE-2026-47174 9.5 CriticalJune 11, 2026
• duck-organization quest-bot Quest Bot: AutoMod removal can delete rules from another guild by global rule ID CVE-2026-47189 8.3 HighJune 11, 2026
• duck-organization quest-bot Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions. CVE-2026-47188 2.3 LowJune 11, 2026
• duck-organization quest-bot Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel CVE-2026-47177 5.7 MediumJune 11, 2026
• duck-organization quest-bot Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel CVE-2026-47176 5.7 MediumJune 11, 2026
• duck-organization quest-bot Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings CVE-2026-47175 2.3 LowJune 11, 2026
• duck-organization quest-bot Quest Bot: Ticket reason allows mass-mention injection CVE-2026-47173 6.3 MediumJune 11, 2026
• duck-organization quest-bot Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment. CVE-2026-47172 Public exploit 9.5 CriticalJune 11, 2026
• duck-organization quest-bot Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here` CVE-2026-47171 8.8 HighJune 11, 2026
• duck-organization quest-bot Quest Bot: Unprivileged users can create and remove AutoMod rules. CVE-2026-47163 7.2 HighJune 11, 2026
• duck-organization quest-bot Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts CVE-2026-47169 7.5 HighJune 11, 2026